IoT regulations remain the primary focus in the sphere of technological innovation
A new Position Paper, sponsored by floLIVE, titled 'Meeting the increasing regulatory challenge in IoT', has been published by Transforma Insights, offering an in-depth examination of key areas of IoT regulation. The report highlights the complex and dynamic regulatory landscape for IoT, which touches almost every aspect of the ecosystem.
Key Trends Shaping IoT Regulations
The report identifies several key trends that are shaping IoT regulations in 2025. These trends focus heavily on security, data sharing, sovereignty, national resilience, and permanent roaming. Significant developments are expected primarily in the European Union (EU) and the United States.
Security
The EU Cyber Resilience Act, effective since December 2024, mandates strict cybersecurity requirements for all connected products. Compliance is required by December 2027 to remain on the EU market. The Act includes secure network pairing, strong authentication, encryption, and privacy-by-design principles. In the United States, the National Institute of Standards and Technology (NIST) updated IoT cybersecurity guidance in 2025 to address evolving risks and clarify data management, including AI component security, and AI-driven threat mitigation.
Data Sharing and Sovereignty
The EU’s updated Radio Equipment Directive, coming into force in August 2025, requires IoT devices with radio modules to implement privacy-by-default and limits on unnecessary data collection, ensuring users maintain control over personal data. This is a move towards data sovereignty and minimizing cross-border unauthorized data flows.
National Resilience
Both the U.S. and EU are building frameworks to strengthen national resilience through IoT. The U.S. executive order mandates that federal agencies procure IoT devices only with certified security marks, boosting trustworthiness of IoT ecosystems.
Permanent Roaming
Although direct regulatory updates in 2025 specifically on "permanent roaming" are less highlighted, the EU’s Radio Equipment Directive and similar frameworks indirectly address challenges of cross-border IoT device operation by enforcing network protection requirements and device authentication.
The Impact of Regulations on IoT Deployments
Organisations deploying IoT solutions must navigate this landscape, balancing compliance with innovation. Regulatory compliance continues to be the single most potentially impactful topic in IoT. The security provisions introduced in the United States, the United Kingdom, and the European Union demand significant investments in cybersecurity infrastructure. Non-compliance with these rules can result in severe penalties, including the disconnection of entire fleets of IoT devices.
The integration of compliance into IoT strategies is an essential element of success in a rapidly evolving ecosystem. Transforma Insights has unveiled its IoT 'Transition Topics' for 2025, which include the integration of regulatory compliance into IoT strategies.
Permanent roaming continues to be a challenge for IoT deployments in many countries, with restrictions enforced on foreign devices. Some countries, such as Brazil, India, and Turkey, have implemented rules prohibiting permanent roaming and require localized connectivity instead.
Data sovereignty laws necessitate robust mechanisms for managing data flows across jurisdictions. The European Union has taken a leadership role with initiatives like the Data Act, which establishes comprehensive rules for sharing IoT-generated data.
In summary, 2025 IoT regulatory frameworks prioritize mandatory cybersecurity standards, privacy protections, and data sovereignty, alongside government-driven certification and device procurement policies that together enhance national security and supply chain trustworthiness. These regulations reflect a global momentum toward secure, resilient IoT ecosystems with enhanced user and national control over data and device operation.
[1] Transforma Insights (2025). Meeting the increasing regulatory challenge in IoT. [2] National Institute of Standards and Technology (2025). IoT Cybersecurity Guidance. [3] European Commission (2024). Cyber Resilience Act. [4] White House (2022). Executive Order on Improving the Nation’s Cybersecurity.
- The report, titled 'Meeting the increasing regulatory challenge in IoT', published by Transforma Insights, highlights the significance of cybersecurity requirements in the European Union (EU) and the United States, with the EU Cyber Resilience Act enforcing strict cybersecurity norms for all connected products and the National Institute of Standards and Technology (NIST) updating IoT cybersecurity guidance in 2025.
- Organisations deploying IoT solutions must carefully address the impact of regulations in 2025. This includes navigating data sovereignty laws, such as the European Union's Data Act, which establishes comprehensive rules for sharing IoT-generated data, and managing challenges related to permanent roaming, as some countries, like Brazil, India, and Turkey, prohibit permanent roaming and require localized connectivity instead.
